{"id":468,"date":"2026-10-08T01:30:26","date_gmt":"2026-10-08T07:00:26","guid":{"rendered":"https:\/\/photonconsole.com\/blog\/?p=468"},"modified":"2026-10-08T10:59:22","modified_gmt":"2026-10-08T16:29:22","slug":"sending-email-from-heroku-without-an-add-on","status":"publish","type":"post","link":"https:\/\/photonconsole.com\/blog\/sending-email-from-heroku-without-an-add-on\/","title":{"rendered":"Sending Email from Heroku Without an Add-On"},"content":{"rendered":"\n

Signup works perfectly on your laptop. You deploy to Heroku, create an account on the live site, and the request hangs. Thirty seconds later the browser shows an application error and your log records H12<\/code>.<\/p>\n\n\n\n

No email arrives. The obvious next move is to look for a blocked port \u2014 but Heroku is not blocking anything.<\/p>\n\n\n\n

Heroku email problems come from the dyno, not from the network. A dyno has no mail server, no fixed outbound address, and no filesystem that survives a restart. Those three facts explain almost every failure, and none of them are fixed by changing a port.<\/p>\n\n\n\n

Quick Answer: How Do You Send Email from Heroku?<\/h2>\n\n\n\n

Point your application directly at an authenticated SMTP relay on port 587, store the credentials in Heroku config vars, and run the send in a worker process rather than inside the web request.<\/p>\n\n\n\n

heroku config:set \\\n  SMTP_HOST=smtp.photonrelay.com \\\n  SMTP_PORT=587 \\\n  SMTP_USER=your_project_api_user \\\n  SMTP_PASS=your_secret_api_key<\/code><\/pre>\n\n\n\n
There is no local mail server to configure and no add-on required. A relay such as PhotonConsole<\/a> is reached over the open submission port like any other outbound API call.<\/p>\n\n\n\n
Why Heroku Is Different From a Blocked Port<\/h2>\n\n\n\n
\"Three
Heroku blocks no ports. Three properties of the dyno break email instead.<\/figcaption><\/figure>\n\n\n\n
On most hosts the problem is a firewall. On Heroku it is the runtime model.<\/p>\n\n\n\n
Platform<\/th>What stops you sending<\/th>Can you change it on the host?<\/th><\/tr><\/thead>
AWS EC2<\/td>Outbound port 25 throttled<\/td>Removal request, sometimes granted<\/td><\/tr>
Google Cloud<\/td>Outbound port 25 blocked<\/td>No removal process exists<\/td><\/tr>
DigitalOcean or VPS<\/td>Port 25 blocked plus IP reputation<\/td>Port sometimes, reputation no<\/td><\/tr>
Heroku<\/td>No mail server and no fixed IP<\/td>No \u2014 there is nothing to configure<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
That last row is the useful one. On Heroku you are not waiting for a support ticket. The relay is the only path, so the work is configuration rather than negotiation.<\/p>\n\n\n\n
Constraint 1: There is no local mail server<\/h3>\n\n\n\n
The dyno image contains your application and its dependencies. It does not contain Postfix, Exim or sendmail<\/code>. Any code path that assumes a local mail transfer agent has nothing to talk to.<\/p>\n\n\n\n
This is why PHP’s mail()<\/code>, Python’s sendmail<\/code> backend and shell-based mail commands fail on Heroku while working on a traditional server. The command is missing, not blocked.<\/p>\n\n\n\n
Constraint 2: There is no stable outbound IP<\/h3>\n\n\n\n
Stable outbound addresses are a Private Spaces feature in Heroku’s dyno runtime documentation<\/a>. On the Common Runtime, where most applications run, they are not offered.<\/p>\n\n\n\n
That matters more than it first appears. SPF authorises sending by IP address or by an included domain. If your dyno’s address changes, you cannot list it in SPF, so the dyno can never be an authorised sender for your domain.<\/p>\n\n\n\n
Sending through a relay sidesteps this entirely: you authorise the relay’s domain once, and your SPF record stays correct no matter how often dynos cycle. With PhotonConsole the SPF entry is a single include<\/code> that never needs updating again.<\/p>\n\n\n\n
Constraint 3: The request has thirty seconds<\/h3>\n\n\n\n
The Heroku router terminates any web request that takes longer than 30 seconds and writes error code H12<\/a> to your logs. The timeout is not configurable.<\/p>\n\n\n\n
An SMTP send involves a DNS lookup, a TCP connection, a TLS handshake, authentication and message transfer. On a slow network path that can exceed the window \u2014 and when it does, the user sees an error even if the mail eventually goes out.<\/p>\n\n\n\n
Quick Fix<\/p>\n\n\n\n
H12 Timeout on Signup or Password Reset<\/p>\n\n\n\n